# Kloudle Cloud Security Scanner (Full Reference)

> Cloud security scanning tools for AI agents. 7 AWS scanners available as static binaries (~2MB each) via MCP.

## About

Kloudle provides cloud security scanners designed for autonomous AI agent workflows. Agents discover and run scanners through the Model Context Protocol (MCP). Each scanner is a self-contained static binary — no SDKs, containers, or dependencies.

## MCP Connection

Add this to any MCP-compatible client configuration:

```json
{
  "mcpServers": {
    "kloudle": {
      "url": "https://mcp.kloudle.dev/mcp"
    }
  }
}
```

Transport: Streamable HTTP (JSON-RPC 2.0 over POST)
Free tier: 50 get() calls per day per IP
No API key required

### MCP Tools

**search(query)** — Find scanners by capability. Returns matching binaries with name, description, check count, and severity breakdown.

**get(name, args?)** — Get full metadata, SHA256 hash, download URL, and ready-to-run shell command for a scanner binary. Pass args to get a complete command; omit for a template with placeholders.

## Exit Codes (all scanners)

- 0: All checks passed
- 1: Misconfigurations found
- 2: Authentication failure
- 3: Network error
- 4: Partial failure (some checks succeeded, some failed)

## Scanner: k5e-aws-s3

S3 bucket security scanner — encryption, public access, versioning, logging, lifecycle

### Checks

| ID | Title | Severity |
|---|---|---|
| KSP-AWS-S3-001 | S3 bucket lacks server-side encryption | high |
| KSP-AWS-S3-002 | S3 bucket has public access enabled | critical |
| KSP-AWS-S3-003 | S3 bucket versioning not enabled | medium |
| KSP-AWS-S3-004 | S3 bucket access logging not enabled | medium |
| KSP-AWS-S3-005 | S3 bucket lacks lifecycle policy | low |

### IAM Permissions

s3:ListAllMyBuckets, s3:GetBucketEncryption, s3:GetPublicAccessBlock, s3:GetBucketPolicyStatus, s3:GetBucketAcl, s3:GetBucketVersioning, s3:GetBucketLogging, s3:GetLifecycleConfiguration

### Arguments

- `--region` (required): AWS region (e.g., us-east-1)
- `--max-resources` (optional): Max buckets to scan (default: all)

## Scanner: k5e-aws-iam

IAM security scanner — root account, MFA, access keys, password policy

### Checks

| ID | Title | Severity |
|---|---|---|
| KSP-AWS-IAM-001 | Root account lacks MFA | critical |
| KSP-AWS-IAM-002 | IAM user has stale access keys (>90 days) | high |
| KSP-AWS-IAM-003 | IAM password policy too weak | high |

### IAM Permissions

iam:GetAccountSummary, iam:ListUsers, iam:ListMFADevices, iam:ListAccessKeys, iam:GetAccessKeyLastUsed, iam:GetAccountPasswordPolicy, iam:GetLoginProfile, iam:GenerateCredentialReport, iam:GetCredentialReport

### Arguments

- `--region` (optional): AWS region (default: us-east-1, IAM is global)

## Scanner: k5e-aws-ec2

EC2 security scanner — public instances, security groups, EBS encryption, IMDSv2

### Checks

| ID | Title | Severity |
|---|---|---|
| KSP-AWS-EC2-001 | EC2 instance has public IP with unrestricted SSH | critical |
| KSP-AWS-EC2-002 | Security group allows unrestricted ingress | high |
| KSP-AWS-EC2-003 | EBS volumes not encrypted | high |
| KSP-AWS-EC2-004 | EC2 instance not using IMDSv2 | medium |

### IAM Permissions

ec2:DescribeInstances, ec2:DescribeSecurityGroups, ec2:DescribeVolumes

### Arguments

- `--region` (required): AWS region (e.g., us-east-1)
- `--max-resources` (optional): Max instances to scan

## Scanner: k5e-aws-eks

EKS cluster security scanner — public endpoint, logging, encryption, RBAC

### Checks

| ID | Title | Severity |
|---|---|---|
| KSP-AWS-EKS-001 | EKS cluster endpoint is publicly accessible | high |
| KSP-AWS-EKS-002 | EKS cluster logging not fully enabled | medium |
| KSP-AWS-EKS-003 | EKS cluster secrets not encrypted with KMS | high |

### IAM Permissions

eks:ListClusters, eks:DescribeCluster

### Arguments

- `--region` (required): AWS region
- `--max-resources` (optional): Max clusters to scan

## Scanner: k5e-aws-rds

RDS instance security scanner — encryption, public access, backups, multi-AZ

### Checks

| ID | Title | Severity |
|---|---|---|
| KSP-AWS-RDS-001 | RDS instance is publicly accessible | critical |
| KSP-AWS-RDS-002 | RDS instance lacks encryption at rest | high |
| KSP-AWS-RDS-003 | RDS automated backups not enabled | high |

### IAM Permissions

rds:DescribeDBInstances

### Arguments

- `--region` (required): AWS region
- `--max-resources` (optional): Max RDS instances to scan

## Scanner: k5e-aws-cloudtrail

CloudTrail security scanner — trail enabled, multi-region, log validation, encryption

### Checks

| ID | Title | Severity |
|---|---|---|
| KSP-AWS-CT-001 | CloudTrail not enabled in all regions | high |
| KSP-AWS-CT-002 | CloudTrail log file validation not enabled | medium |
| KSP-AWS-CT-003 | CloudTrail logs not encrypted with KMS | medium |

### IAM Permissions

cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus

### Arguments

- `--region` (required): AWS region

## Scanner: k5e-aws-cloudwatch-logs

CloudWatch Logs security scanner — retention, encryption, metric filters

### Checks

| ID | Title | Severity |
|---|---|---|
| KSP-AWS-CWL-001 | CloudWatch log group has no retention policy | medium |
| KSP-AWS-CWL-002 | CloudWatch log group not encrypted with KMS | medium |
| KSP-AWS-CWL-003 | No metric filters for critical events | low |

### IAM Permissions

logs:DescribeLogGroups, logs:DescribeMetricFilters

### Arguments

- `--region` (required): AWS region
- `--max-resources` (optional): Max log groups to scan